Skip to content
This repository

Default host to localhost when in development mode. #514

Merged
merged 5 commits into from 12 months ago

4 participants

Postmodern James Tucker Markus Prinz Bryan Helmkamp
Postmodern

Running Rack apps on 0.0.0.0 in development mode will allow malicious users on the local network (ex: a Coffee Shop or a Conference) to abuse or potentially exploit the app. Safer to default host to localhost when in development mode.

Also default the :Host option to localhost, when in development, in Rack::Handler::WEBrick, Rack::Handler::Mongrel, Rack::Handler::Thin.

added some commits February 09, 2013
Postmodern Default host to localhost when in development mode.
* Running Rack apps on 0.0.0.0 in development mode will allow malicious
  users on the local network (ex: a Coffee Shop or a Conference) to abuse
  or potentially exploit the app. Safer to default host to localhost when in
  development mode.
28b0144
Postmodern Rack::Handler::WEBrick: default the host to localhost in development …
…mode.
5a9169d
Postmodern Rack::Handler::Mongrel: default the host to localhost in development …
…mode.
5d2edd8
Postmodern Rack::Handler::Thin: default the host to localhost in development mode. 8377df0
James Tucker
Owner

Using a hostname can cause issues on some systems where servers don't properly support ipv6. Should we prefer 127.0.0.1?

Postmodern

Using 127.0.0.1 would assume the system supports IPv4. Better to use localhost and let /etc/hosts map it to the correct address/interface.

Markus Prinz

Either way, right now the valid_options returns incorrect documentation for the default host value where applicable (it says localhost right now, at least for Thin and Mongrel). So if this pull request is rejected, that method should be updated to use the correct default host.

@raggi Would it avoid the issues you mentioned if we use Socket.ip_address_list to detect the IP for localhost?

Postmodern

Fixed valid_options. I noticed there is some repetition among the valid_options methods. Perhaps they could be extracted to a common Handler class/module?

Bryan Helmkamp

Wouldn't a better default be localhost in production too? For example, in the common configuration of Ruby behind Nginx on an EC2 server. 0.0.0.0 seems better as an opt-in behavior.

Postmodern

@brynary Good idea. I don't know how that might affect Phusion Passenger or Heroku (they default to using WEBrick). In the past, I would configure Thin to explicitly listen on localhost:9000.

Bryan Helmkamp
James Tucker raggi merged commit 15796c4 into from April 22, 2013
James Tucker raggi closed this April 22, 2013
James Tucker
Owner
raggi commented April 22, 2013

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Showing 5 unique commits by 1 author.

Feb 09, 2013
Postmodern Default host to localhost when in development mode.
* Running Rack apps on 0.0.0.0 in development mode will allow malicious
  users on the local network (ex: a Coffee Shop or a Conference) to abuse
  or potentially exploit the app. Safer to default host to localhost when in
  development mode.
28b0144
Postmodern Rack::Handler::WEBrick: default the host to localhost in development …
…mode.
5a9169d
Postmodern Rack::Handler::Mongrel: default the host to localhost in development …
…mode.
5d2edd8
Postmodern Rack::Handler::Thin: default the host to localhost in development mode. 8377df0
Feb 27, 2013
Postmodern Determine the default value for Host, based on the environment. a5e61c9
This page is out of date. Refresh to see the latest.
5  lib/rack/handler/fastcgi.rb
@@ -30,8 +30,11 @@ def self.run(app, options={})
30 30
       end
31 31
 
32 32
       def self.valid_options
  33
+        environment  = ENV['RACK_ENV'] || 'development'
  34
+        default_host = environment == 'development' ? 'localhost' : '0.0.0.0'
  35
+
33 36
         {
34  
-          "Host=HOST" => "Hostname to listen on (default: localhost)",
  37
+          "Host=HOST" => "Hostname to listen on (default: #{default_host})",
35 38
           "Port=PORT" => "Port to listen on (default: 8080)",
36 39
           "File=PATH" => "Creates a Domain socket at PATH instead of a TCP socket. Ignores Host and Port if set.",
37 40
         }
10  lib/rack/handler/mongrel.rb
@@ -7,8 +7,11 @@ module Rack
7 7
   module Handler
8 8
     class Mongrel < ::Mongrel::HttpHandler
9 9
       def self.run(app, options={})
  10
+        environment  = ENV['RACK_ENV'] || 'development'
  11
+        default_host = environment == 'development' ? 'localhost' : '0.0.0.0'
  12
+
10 13
         server = ::Mongrel::HttpServer.new(
11  
-          options[:Host]           || '0.0.0.0',
  14
+          options[:Host]           || default_host,
12 15
           options[:Port]           || 8080,
13 16
           options[:num_processors] || 950,
14 17
           options[:throttle]       || 0,
@@ -39,8 +42,11 @@ def self.run(app, options={})
39 42
       end
40 43
 
41 44
       def self.valid_options
  45
+        environment  = ENV['RACK_ENV'] || 'development'
  46
+        default_host = environment == 'development' ? 'localhost' : '0.0.0.0'
  47
+
42 48
         {
43  
-          "Host=HOST" => "Hostname to listen on (default: localhost)",
  49
+          "Host=HOST" => "Hostname to listen on (default: #{default_host})",
44 50
           "Port=PORT" => "Port to listen on (default: 8080)",
45 51
           "Processors=N" => "Number of concurrent processors to accept (default: 950)",
46 52
           "Timeout=N" => "Time before a request is dropped for inactivity (default: 60)",
5  lib/rack/handler/scgi.rb
@@ -17,8 +17,11 @@ def self.run(app, options=nil)
17 17
       end
18 18
 
19 19
       def self.valid_options
  20
+        environment  = ENV['RACK_ENV'] || 'development'
  21
+        default_host = environment == 'development' ? 'localhost' : '0.0.0.0'
  22
+
20 23
         {
21  
-          "Host=HOST" => "Hostname to listen on (default: localhost)",
  24
+          "Host=HOST" => "Hostname to listen on (default: #{default_host})",
22 25
           "Port=PORT" => "Port to listen on (default: 8080)",
23 26
         }
24 27
       end
10  lib/rack/handler/thin.rb
@@ -6,7 +6,10 @@ module Rack
6 6
   module Handler
7 7
     class Thin
8 8
       def self.run(app, options={})
9  
-        host = options.delete(:Host) || '0.0.0.0'
  9
+        environment  = ENV['RACK_ENV'] || 'development'
  10
+        default_host = environment == 'development' ? 'localhost' : '0.0.0.0'
  11
+
  12
+        host = options.delete(:Host) || default_host
10 13
         port = options.delete(:Port) || 8080
11 14
         args = [host, port, app, options]
12 15
         # Thin versions below 0.8.0 do not support additional options
@@ -17,8 +20,11 @@ def self.run(app, options={})
17 20
       end
18 21
 
19 22
       def self.valid_options
  23
+        environment  = ENV['RACK_ENV'] || 'development'
  24
+        default_host = environment == 'development' ? 'localhost' : '0.0.0.0'
  25
+
20 26
         {
21  
-          "Host=HOST" => "Hostname to listen on (default: localhost)",
  27
+          "Host=HOST" => "Hostname to listen on (default: #{default_host})",
22 28
           "Port=PORT" => "Port to listen on (default: 8080)",
23 29
         }
24 30
       end
10  lib/rack/handler/webrick.rb
@@ -6,7 +6,10 @@ module Rack
6 6
   module Handler
7 7
     class WEBrick < ::WEBrick::HTTPServlet::AbstractServlet
8 8
       def self.run(app, options={})
9  
-        options[:BindAddress] = options.delete(:Host) if options[:Host]
  9
+        environment  = ENV['RACK_ENV'] || 'development'
  10
+        default_host = environment == 'development' ? 'localhost' : '0.0.0.0'
  11
+
  12
+        options[:BindAddress] = options.delete(:Host) || default_host
10 13
         options[:Port] ||= 8080
11 14
         @server = ::WEBrick::HTTPServer.new(options)
12 15
         @server.mount "/", Rack::Handler::WEBrick, app
@@ -15,8 +18,11 @@ def self.run(app, options={})
15 18
       end
16 19
 
17 20
       def self.valid_options
  21
+        environment  = ENV['RACK_ENV'] || 'development'
  22
+        default_host = environment == 'development' ? 'localhost' : '0.0.0.0'
  23
+
18 24
         {
19  
-          "Host=HOST" => "Hostname to listen on (default: localhost)",
  25
+          "Host=HOST" => "Hostname to listen on (default: #{default_host})",
20 26
           "Port=PORT" => "Port to listen on (default: 8080)",
21 27
         }
22 28
       end
7  lib/rack/server.rb
@@ -185,11 +185,14 @@ def options
185 185
     end
186 186
 
187 187
     def default_options
  188
+      environment  = ENV['RACK_ENV'] || 'development'
  189
+      default_host = environment == 'development' ? 'localhost' : '0.0.0.0'
  190
+
188 191
       {
189  
-        :environment => ENV['RACK_ENV'] || "development",
  192
+        :environment => environment,
190 193
         :pid         => nil,
191 194
         :Port        => 9292,
192  
-        :Host        => "0.0.0.0",
  195
+        :Host        => default_host,
193 196
         :AccessLog   => [],
194 197
         :config      => "config.ru"
195 198
       }
Commit_comment_tip

Tip: You can add notes to lines in a file. Hover to the left of a line to make a note

Something went wrong with that request. Please try again.